Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-13541 | adirectory (WordPress plugin) | The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabil | medium | 4.3 | 0% |
| CVE-2024-13361 | gpt3-ai-content-generator (WordPress plugin) | The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_sav | medium | 6.3 | 0% |
| CVE-2024-12370 | wp-hotel-booking (WordPress plugin) | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding r | medium | 5.3 | 0% |
| CVE-2024-5545 | motors-car-dealership-classified-listings (WordPress plugin) | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa | medium | 5.3 | 0% |
| CVE-2024-8658 | mycred (WordPress plugin) | The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, an | medium | 5.3 | 0% |
| CVE-2024-8678 | revolut-gateway-for-woocommerce (WordPress plugin) | The Revolut Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec | medium | 5.3 | 0% |
| CVE-2024-12113 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2025-3915 | aeropage-sync-for-airtable (WordPress plugin) | The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aer | medium | 4.3 | 0% |
| CVE-2025-10352 | melisplatform/melis-core | Melis Platform CMS Unauthenticated Admin Account Creation | critical | 0.0 | 0% |
| CVE-2024-3268 | youtube-showcase (WordPress plugin) | The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modifi | medium | 5.3 | 0% |
| CVE-2024-9686 | order-notification-for-telegram (WordPress plugin) | The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability chec | medium | 5.3 | 0% |
| CVE-2024-13698 | jobify (WordPress theme) | The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabili | medium | 6.5 | 0% |
| CVE-2024-6872 | templatespare (WordPress plugin) | The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenber | medium | 4.3 | 0% |
| CVE-2024-1125 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capa | medium | 5.4 | 0% |
| CVE-2024-8121 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a miss | medium | 5.4 | 0% |
| CVE-2024-1804 | tutor-lms-migration-tool (WordPress plugin) | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | medium | 4.3 | 0% |
| CVE-2024-32818 | wordpress-meta-data-and-taxonomies-filter (WordPress plugin) | Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data an | medium | 4.3 | 0% |
| CVE-2024-6709 | sync-post-with-other-site (WordPress plugin) | The Sync Post With Other Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2024-6836 | funnel-builder (WordPress plugin) | The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells | medium | 4.3 | 0% |
| CVE-2024-8427 | frontend-post-submission-manager-lite (WordPress plugin) | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modificatio | medium | 4.3 | 0% |
| CVE-2024-9067 | youzify (WordPress plugin) | The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to una | medium | 4.3 | 0% |
| CVE-2024-9361 | bulk-image-resizer (WordPress plugin) | The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of da | medium | 4.3 | 0% |
| CVE-2024-9685 | notification-for-telegram (WordPress plugin) | The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on t | medium | 4.3 | 0% |
| CVE-2023-7019 | wp-maintenance-mode (WordPress plugin) | The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of d | medium | 4.3 | 0% |
| CVE-2026-33685 | wwbn/avideo | AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data | medium | 5.3 | 0% |
| CVE-2023-6883 | easy-facebook-likebox (WordPress plugin) | The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple A | medium | 4.3 | 0% |
| CVE-2024-1124 | eventprime-event-calendar-management (WordPress plugin) | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing cap | medium | 4.3 | 0% |
| CVE-2024-13716 | fx-calculators (WordPress plugin) | The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_ | medium | 4.3 | 0% |
| CVE-2024-2298 | affiliate-toolkit-starter (WordPress plugin) | The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability che | medium | 4.3 | 0% |
| CVE-2026-25633 | statamic/cms | Statamic CMS's missing authorization allows access to assets | medium | 4.3 | 0% |
| CVE-2024-10520 | wedevs-project-manager (WordPress plugin) | The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'che | medium | 5.3 | 0% |
| CVE-2025-32045 | moodle/moodle | Moodle shows hidden grades to users without permission on some grade reports | medium | 5.3 | 0% |
| CVE-2022-2405 | wp-popup-builder (WordPress plugin) | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated | medium | 4.3 | 0% |
| CVE-2022-2657 | multivendor-marketplace-solution-for-woocommerce---wc-marketplace (WordPress plugin) | The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actio | medium | 4.3 | 0% |
| CVE-2026-35448 | wwbn/avideo | AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php | low | 3.7 | 0% |
| CVE-2024-5382 | master-addons (WordPress plugin) | The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthor | medium | 6.5 | 0% |
| CVE-2024-5674 | newsletter (WordPress plugin) | The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issu | medium | 6.5 | 0% |
| CVE-2024-6755 | social-auto-poster (WordPress plugin) | The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on | medium | 6.5 | 0% |
| CVE-2024-6590 | wpgsi (WordPress plugin) | The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as | medium | 6.3 | 0% |
| CVE-2023-7287 | paytium (WordPress plugin) | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized subscription cancellation due to a missing | medium | 5.4 | 0% |
| CVE-2024-2017 | countdown-builder (WordPress plugin) | The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capab | medium | 5.4 | 0% |
| CVE-2024-9584 | image-map-pro (WordPress plugin) | The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check | medium | 5.4 | 0% |
| CVE-2024-5857 | funnelforms-free (WordPress plugin) | The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to un | medium | 5.3 | 0% |
| CVE-2023-4728 | ladipage (WordPress plugin) | The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publish_lp() fu | medium | 4.3 | 0% |
| CVE-2024-11134 | eventer (WordPress plugin) | The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_booki | medium | 4.3 | 0% |
| CVE-2026-33159 | craftcms/cms | Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations | medium | 0.0 | 0% |
| CVE-2022-0398 | thirstyaffiliates-affiliate-link-manager (WordPress plugin) | The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili | medium | 5.4 | 0% |
| CVE-2024-13520 | gift-vouchers (WordPress plugin) | The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data| | medium | 5.3 | 0% |
| CVE-2024-6869 | falang (WordPress plugin) | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c | medium | 5.4 | 0% |
| CVE-2024-13554 | wpextended (WordPress plugin) | The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca | medium | 5.3 | 0% |